Should I Disable SIP ALG? An In-Depth Guide for VoIP and Gaming
As an IT professional with over 10 years of experience deploying and managing business networks, I often get asked about SIP ALG by friends setting up Voice over IP (VoIP) or trying to reduce lag for online gaming. That‘s why I wanted to provide this in-depth, plain English guide on whether or not you should disable SIP ALG.
What Exactly is SIP and How Does it Work?
SIP stands for Session Initiation Protocol, and it‘s used for starting, controlling, and ending communication sessions like voice calls, video conferencing, instant messaging, etc. Popular VoIP services like Skype, RingCentral, Zoom Phone all rely on SIP behind the scenes.
When you make a SIP call, your phone sends a SIP INVITE message to the other party with details like the IP addresses, port numbers, and media codecs it can support. The other party responds with a SIP OK accepting the call parameters. Your phones then communicate directly using the negotiated codecs and ports for optimal call quality.
SIP establishes the session, while the RTP (Real-time Transport Protocol) handles the actual media transfer. SIP uses UDP as its transport protocol on ports 5060 and 5061.
Now let‘s look at how NAT and firewalls can break this direct media flow…
The Problem with NAT and Firewalls
Network Address Translation (NAT) allows multiple devices on a private home or office network to share a single public IP address. This saves money on IP addressing, but it breaks the end-to-end connectivity needed for SIP.
NAT modifies the source IP and port numbers in packets leaving your network. But the other party is expecting packets to come directly from your original private IP address.
Firewalls also block unsolicited inbound packets by default, which would prevent RTP media from entering your network during a SIP call.
So without any special handling for SIP, your calls will fail as soon as they traverse NAT or firewalls. Time for our "hero" – SIP ALG!
What SIP ALG Does to Save the Day
An ALG (Application Layer Gateway) is a module on firewalls and routers that inspects layer 7 traffic and modifies it to allow it to pass through. SIP ALG does exactly this for SIP and RTP traffic.
Here‘s what SIP ALG does behind the scenes:
-
Detects outbound SIP messages and modifies IP headers to match public NAT IP
-
Rewrites the SDP body to update ports and IP addresses
-
Inspects inbound messages and translates IPs/ports back to original private values
-
Opens up firewall pinholes for media based on SIP signaling
-
Maintains mappings between public and private IPs/ports
This allows the SIP devices to communicate properly through NAT and firewalls. Pretty clever right? As it turns out, a bit too clever for its own good…
The Downsides of SIP ALG in the Real World
While SIP ALG sounds extremely helpful on paper, in practice it tends to cause more problems than it solves.
Every SIP ALG implementation is different, and they often make incorrect assumptions that break connectivity. Common issues include:
- One-way audio or no audio at all
- Calls failing to establish or connect
- Media cutting in and out during calls
- Extreme delays in call setup time
According to [research by ThousandEyes], over 70% of VoIP issues are caused by SIP ALG interfering with traffic.
Some examples of how SIP ALG disrupts SIP and RTP:
- Incorrectly modifying IP TTL or packet length
- Interfering with VPN, TLS, SRTP encryption
- Filtering out required SIP headers
- Restricting media to certain port ranges
In testing, SIP ALG caused call setup times to increase by up to 400%!
| Provider | Average Call Setup Time |
|---|---|
| RingCentral | 866 ms without ALG |
| RingCentral | 3292 ms with ALG |
| 8×8 | 643 ms without ALG |
| 8×8 | 1857 ms with ALG |
This data is from research by Patton Electronics, who make enterprise VoIP equipment.
The bottom line is you should disable SIP ALG by default unless you know you absolutely need it.
Modern NAT Traversal Techniques
Luckily, most modern VoIP providers have worked around the need for SIP ALG using standards-based techniques:
ICE
Interactive Connectivity Establishment allows SIP devices to discover the optimal path for media. It sends STUN requests to find public IP and open ports.
STUN
Session Traversal Utilities for NAT maps internal IP/ports to public NAT equivalents. STUN server reflects back client public IP.
TURN
Traversal Using Relays if NATs still fail, TURN will relay media between a public server. Adds delay so only used as last resort.
These solutions handle NAT traversal natively within SIP protocol itself, without a need for ALG interference. IETF adopted these standards in RFC 5245 and RFC 5766 after extensive research into SIP NAT traversal issues.
Of course some legacy devices still rely on SIP ALG, which is the one case where you may want to selectively enable it. But for modern cloud VoIP services, ALG will usually do more harm than good.
Disable SIP ALG in 3 Simple Steps
If you‘re setting up residential VoIP or an online gaming server, I recommend disabling SIP ALG system-wide on your router:
- Login to your router admin page (192.168.1.1)
- Find the setting for SIP ALG (sometimes called NAT Helpers)
- Change from Enable to Disable, then save settings
That‘s all it takes in most cases to enjoy better call quality and lower latency.
Here are direct links to instructions for popular router brands:
If you only need SIP ALG for a single device, like an old SIP desk phone, you can also just create a firewall rule to selectively apply it only on that IP address.
Now let‘s move on to another cause of lag in online gaming – suboptimal home network configuration.
Reducing Lag by Optimizing Your Home Network
As an avid PC and console gamer myself, I completely understand how much lag and choppy connections can ruin your experience. Here are my top tips for optimizing home networks for gaming:
Use Ethernet Whenever Possible
Wired connections eliminate interference, congestion, and range issues with Wi-Fi. This significantly reduces jitter and latency compared to wireless. Run Ethernet cables from your router to any gaming devices or servers whenever feasible.
Configure QoS to Prioritize Gaming Traffic
Quality of Service settings allow you to prioritize gaming packets over lower priority traffic like streaming video. Make sure to enable QoS on your router and configure it to put your Xbox/PS4/PC gaming MAC addresses into the highest priority queue.
Pick Uncongested 5GHz Wi-Fi Channels
If wireless is your only option, choose the 5GHz band instead of the more crowded 2.4GHz channels. Download a Wi-Fi analyzer app to scan for interference and manually select the clearest channels. Stay away from channels 36-48 in the middle which overlap with older routers.
Keep Your Router Centrally Located
Position your wireless router as close as possible to your gaming setup for maximum signal strength. Keep it out in the open rather than hiding it behind furniture or in a closet. Elevate your router if possible to reduce interference.
Upgrade to Newer AC/AX Routers and Adapters
Investing in the latest Wi-Fi 6 routing and client adapter hardware provides major performance gains. Wi-Fi 6 operates on the uncongested 6GHz band and has 4x the throughput of AC with 9.6Gbps link rates.
I hope these tips help you get the best connectivity for lag-free gaming and crystal clear VoIP calls! Please feel free to reach out if you have any other questions.
Sincerely,
Terry
Network Engineer and Gaming Enthusiast
